Cyber Resilience

CVE-2025-20617

HighRCE

Published: 22 January 2025

Published
22 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20617 is a high-severity OS Command Injection (CWE-78) vulnerability in Jvn (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-20617 is an OS command injection vulnerability (CWE-78) present in I-O DATA UD-LT2 firmware versions 1.00.008_SE and earlier. The flaw stems from improper neutralization of special elements in requests tied to specific administrative screen operations, allowing an authenticated administrator to inject and execute arbitrary operating-system commands on the device.

An attacker who has already obtained administrative credentials can exploit the issue over the network by crafting malicious requests to the affected screen. Successful exploitation grants the attacker the ability to run arbitrary OS commands, resulting in full control over the confidentiality, integrity, and availability of the device.

The vendor advisory at iodata.jp and the corresponding JVN publication recommend updating UD-LT2 firmware to a version that corrects the command-handling flaw; no work-arounds are specified.

EPSS for the CVE rose from a low baseline to a peak of 0.0137 in December 2025 before receding to its current value of 0.0027, indicating a temporary increase in observed exploitation interest after disclosure.

EU & UK References

Vulnerability details

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain…

more

screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-26856.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Jvn
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References